1. Submit test123 in the box. Notice: no parameter appears in the URL — your input rode in the request body.
2. Devtools → Network → click the POST request → look at the body. The app has more parameters than the form hinted at.
3. Give each hidden parameter its own unique marker (change the value, then submit — edit the request in devtools or a proxy, or replay it with curl).
4. One parameter at a time: is <u>marker</u> rendered for each of them? Then escalate each to JavaScript.

The method doesn't matter — GET, POST, PUT: anywhere the app takes input and hands it back is a candidate. And a later course section covers CSRF — that's what makes a reflected POST XSS deliverable to victims, which is why it's worth the same effort as a GET one.

• name — the visible input, reflected in "Hello" and in the profile.
• color — hidden input (default blue), reflected as favorite color.
• newsletter — hidden input (default weekly), reflected at the bottom.

curl -X POST https://stuxnet.pro/xss/lab2/index.php \
  --data-urlencode 'name=<img src=x onerror=alert(1)>' \
  --data-urlencode 'color=<button onmouseover=alert(1)>hover me</button>' \
  --data-urlencode 'newsletter=<script>alert(1)</script>'

Replay that from a proxy (change the method/body, keep the cookies) — same skill set you'll use to retake requests on real targets.